AZ_INTUNE_ADMIN

Summary

Forestall ACL Alias	AZ_INTUNE_ADMIN
Entra ID (Azure AD) Alias	Intune Administrator
Affected Object Types	Tenant, Groups (and, when scoped to an Administrative Unit, the users/groups/devices in that unit)
Exploitation Certainty	Certain
Graph Permission / Role	Membership in the built-in Intune Administrator directory role (3a2c62db-5318-420d-8d74-23affee5d9d5), direct or via a role-assignable group

Description

AZ_INTUNE_ADMIN represents the ability for a principal to operate as an Intune Administrator in Microsoft Entra ID. Intune Administrator is a Tier 0 directory role because it controls device management and can be abused to run code on managed endpoints and to manipulate group membership.

The collector treats Intune Administrator as a privileged-role attack path and draws two kinds of edges from any principal that holds it:

• A tenant-level AZ_INTUNE_ADMIN edge to the tenant (for tenant-wide assignments).

• An AZ_ADD_MEMBERS edge, because Intune Administrator can add members to non-role-assignable groups (see AZ_ADD_MEMBERS).

When the role is scoped to an Administrative Unit, the edges target the users, groups, and devices contained in that unit instead of the whole tenant.

The core abuse comes from device management: an Intune Administrator can push configuration profiles, PowerShell scripts, and applications to enrolled devices, executing code as SYSTEM on every managed endpoint the policy reaches.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"

# List members of the Intune Administrator role
Get-MgRoleManagementDirectoryRoleAssignment `
  -Filter "roleDefinitionId eq '3a2c62db-5318-420d-8d74-23affee5d9d5'" `
  -ExpandProperty Principal |
  Select-Object PrincipalId, DirectoryScopeId,
    @{N='Type';E={$_.Principal.AdditionalProperties.'@odata.type'.Split('.')[-1]}},
    @{N='Name';E={$_.Principal.AdditionalProperties.displayName}}

Azure Portal

1. Open Microsoft Entra admin center -> Roles & administrators.

2. Open Intune Administrator -> Assignments.

3. Record active and eligible (PIM) assignments; expand any assigned group to its transitive members.

4. Note the Scope column: Directory is tenant-wide, an object name is a scoped assignment.

Exploitation

An Intune Administrator can manage devices and the policies applied to them. Common abuse patterns:

• Code execution on managed devices - deploy a PowerShell script or Win32 app through Intune to run as SYSTEM on enrolled endpoints, harvesting credentials or tokens.

• Configuration tampering - push device configuration or compliance profiles that weaken security posture.

• Group membership - add controlled principals to non-role-assignable groups that grant downstream access.

Related Attack Paths:

• AZ_ADD_MEMBERS - the group-membership edge this role also produces.

Mitigation

• Keep Intune Administrator assignments minimal and prefer eligible (PIM) assignments with MFA and approval.

• Restrict who can author and assign device configuration and scripts.

• Scope the role to Administrative Units where tenant-wide device control is not required.

• Review role membership and Intune script/app deployments regularly.

Detection

Use the Microsoft Entra admin center and Intune:

1. Open Microsoft Entra ID -> Audit logs and filter Activity for role assignment changes targeting Intune Administrator.

2. In the Microsoft Intune admin center, review Audit logs for new device configuration profiles, scripts, and app deployments.

3. Review Initiated by (actor), Target, Date, and Status for unexpected changes.

4. Open Roles & administrators -> Intune Administrator -> Assignments to confirm current assignments and recent activations.

References

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#intune-administrator

• https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control

• https://specterops.github.io/TierZeroTable/

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs